Privacy Policy

This Privacy Policy explains how DUPLE.AI LLC, a Delaware limited liability company ("Duple," "we," "us" or "our"), collects, uses, shares and protects personal information when you use the Duple website at duple.ai, the Duple application at app.duple.ai and our related services (the "Service"), and the choices and rights you have. Capitalized terms not defined here have the meanings given in our Terms of Service.

Duple is the controller (or "business") responsible for your personal information. This policy does not cover third-party websites or services that the Service links to or that you choose to use, including the AI Model Providers, which have their own privacy policies.

1. The short version

• We don't sell your personal information, and we don't share it for targeted or cross-context behavioral advertising.
• We don't use your chats, files or memories to train AI models.
• No ads and no third-party analytics or tracking cookies. The only cookie we set is the one that keeps you signed in.
• Your messages go to the AI model you choose. To answer you, we send your prompt and the context it needs to that model's provider through OpenRouter (Section 5).
• You're in control. You can export your data, delete chats, memories and projects, turn memory off, use temporary chats, and delete your account at any time from Settings.

2. Information we collect

Information you give us

• Account information: your name, email address and password. Passwords are stored only as a one-way cryptographic hash; we cannot see them.
• Your Content: the prompts and messages you send; the responses generated for you; conversation titles; projects, project instructions and project files; images, PDFs and other files you upload; memories you add, edit or import; and any data you import from other services.
• Support and communications: what you write when you contact us, and anything you attach. Emails started from the Help tab are pre-filled with your Account ID, browser and window size so we can help you; you can delete those lines before sending.
• Purchase information: when you buy a plan or credits, our payment processor collects your payment details. We receive only limited information from it — such as the plan purchased, amount, currency, date, payment status, a customer or transaction reference, and, where the processor provides it, your billing country. We do not receive or store your full card number.

Information collected automatically

• Usage and billing records: which models you use, when, the number of tokens processed, credits charged and granted, and related identifiers (for example, conversation and message IDs). This is the history shown in Settings → Usage.
• Device, log and session information: IP address, browser and operating system (user agent), device type, the date and time of requests, pages and features used, and error information. Each signed-in session records its device and last activity, which is how Settings → Account shows "Where you're signed in." Our hosting providers keep short-lived request logs.
• Security information: rate-limit and abuse-prevention counters derived from your IP address and email address, stored as keyed cryptographic hashes rather than in plain form.
• Cookies and local storage: see Section 7.

Information we generate

• Memories: if "Learn from chats" is on in Settings → Memory, the Service uses an AI model to identify durable facts and preferences from your messages and saves them as memories you can see, edit and delete. Sensitive topics are only saved if you turn them on.
• Conversation summaries and titles: long conversations are automatically summarized so that they keep fitting in a model's context window, and new chats may be titled automatically.
• Embeddings: numerical representations of your memories, used to find the ones relevant to a message.

We do not knowingly collect precise geolocation, biometric identifiers, or government identification numbers, and we ask you not to submit sensitive personal information you do not need the Service to process.

3. How we use information

We use personal information to:

• Provide the Service: create and secure your account; send your prompts and context to the model you choose and show you its response; store and search your history, projects, files and memories; generate summaries and titles; and import and export your data.
• Bill and meter usage: grant, track and charge credits; manage plans, renewals and cancellations; prevent and resolve billing errors, refunds and chargebacks.
• Keep the Service safe: authenticate you; detect, prevent and respond to fraud, abuse, security incidents, and violations of our Terms and Acceptable Use Policy; enforce rate limits and spending safeguards.
• Communicate with you: send transactional and service messages (for example, password reset emails, billing notices, renewal reminders and changes to our terms) and respond to support requests. We do not send marketing email without any consent the law requires, and you can opt out of marketing at any time.
• Operate and improve the Service: monitor performance, debug errors, and understand aggregate usage (for example, which models are used), using the minimum information needed. We do not use Your Content to train AI models.
• Comply with law and protect rights: meet legal, tax, accounting and regulatory obligations; respond to lawful requests; and establish, exercise or defend legal claims.

We may use automated systems to apply limits or restrict an account (for example, rate limits, spending safeguards, or blocking a request that violates our policies). We do not use automated decision-making that produces legal or similarly significant effects on you as defined by data protection law.

4. Legal bases (European Economic Area, United Kingdom and Switzerland)

If data protection law in these places applies, we process personal information on the following legal bases: performance of our contract with you (to provide the Service, bill you and support you); legitimate interests (to secure the Service, prevent fraud and abuse, improve the Service and defend legal claims, where those interests are not overridden by your rights); consent (for example, saving sensitive memories, which is off unless you turn it on; you may withdraw consent at any time); and legal obligation (for example, tax and accounting records).

5. How AI processing works

When you send a message, we send it — together with the context the model needs, such as earlier messages in the conversation, a conversation summary, relevant project instructions and files, your attachments and relevant memories — to OpenRouter, which routes it to the provider that hosts the model you selected (for example OpenAI, Anthropic, Google, xAI or Perplexity, or a cloud provider hosting their models). The provider processes this information to generate the response, which comes back to us and is stored in your account.

• Model Providers and OpenRouter process your information under their own terms and privacy policies, and some may retain inputs and outputs for limited periods (for example, for abuse monitoring or legal compliance). We do not control their practices. We encourage you to review the policies of the providers whose models you use.
• For the background processing we do on your behalf — extracting memories and summarizing long conversations — we instruct OpenRouter to route only to providers that do not collect the data for their own purposes.
• Web search models send your query to search services to retrieve results.
• Please do not include information in your prompts or files that you do not want processed by these providers.

6. How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:

• Service providers that process it on our behalf and under contract, to provide the Service:
  • Convex — database, backend functions and file storage (United States);
  • Vercel — website and application hosting and delivery;
  • OpenRouter and the AI Model Providers described in Section 5 — generating responses, memories and summaries;
  • Resend — sending transactional email, such as password reset links;
  • Microsoft (Microsoft 365) — our support mailbox, when you email us;
  • our payment processor (currently Whop) — processing purchases, renewals, refunds and disputes.
• Legal and safety: to comply with law, regulation, legal process or an enforceable government request; to enforce our agreements; to detect, prevent or address fraud, security or technical issues; to protect the rights, property or safety of Duple, our users or the public; and to report child sexual abuse material to the National Center for Missing & Exploited Children and law enforcement as required by law.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets or similar transaction, in which case personal information may be transferred to the successor, subject to this policy or a policy that is at least as protective.
• With your direction or consent: for example, when you choose to share something.
• Aggregated or de-identified information that cannot reasonably be used to identify you, which we may use and share for any lawful purpose.

7. Cookies and local storage

We use only what the Service needs to work:

• A sign-in cookie. A first-party, secure, HTTP-only session cookie keeps you signed in. A session lasts about a week from your last visit, and you can end it at any time by signing out or from "Where you're signed in."
• Your browser's local and session storage for things that stay on your device, such as whether the sidebar is open and drafts of messages you haven't sent yet. Drafts are cleared when you sign out.

We do not use advertising cookies, third-party analytics, tracking pixels or cross-site trackers. Because we do not sell or share personal information or track you across sites, we do not respond differently to "Do Not Track" signals; we honor Global Privacy Control signals as a request to opt out of sale and sharing, which we already do not do.

8. How long we keep information

• Account information and Your Content are kept while your account is active, until you delete them. You can delete individual chats, projects, files and memories at any time.
• Temporary chats are deleted automatically about 24 hours after their last activity, and are never used for memory.
• Uploaded files that are never sent are deleted after about an hour.
• When you delete your account, we delete your profile, chats, messages, projects, files, memories, preferences and sessions. Deletion starts immediately and normally completes within minutes to hours.
• Billing and transaction records (credit ledger, subscriptions and payment records) are retained, pseudonymized and detached from your profile, for as long as needed for accounting, tax, fraud prevention, dispute and legal purposes — generally up to seven years.
• Backups and logs: deleted information may remain in backups and in service-provider logs for a limited period until they are overwritten or expire in the normal course.
• Support emails are kept as long as needed to handle your request and for our records.

We may also keep information longer where required by law, or to establish, exercise or defend legal claims.

9. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (HTTPS with HSTS), hashed passwords, encryption at rest by our infrastructure providers, access controls and least-privilege access, and per-account authorization checks on every request. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for signing out of shared devices. If we learn of a security breach that affects your personal information, we will notify you and the authorities as required by law.

10. Your choices and rights

In the Service, at any time:

• Access and portability: download everything stored for your account as a JSON file from Settings → Account → Export your data.
• Correction: edit your name in Settings → Account, and edit or delete memories in Settings → Memory.
• Deletion: delete chats, projects, files and memories, or your whole account from Settings → Account → Delete account.
• Memory controls: turn off memory, turn off learning from chats, keep sensitive topics off, or use temporary chats.

Privacy rights requests. Depending on where you live, you may have the right to know or access the personal information we hold about you; to correct it; to delete it; to receive a portable copy; to object to or restrict certain processing; to withdraw consent; to opt out of sale, sharing, targeted advertising or certain profiling (which we do not engage in); and to appeal a decision about your request. To make a request, email support@duple.ai with the subject "Privacy Request" from the email address on your account, including your Account ID. We will verify your identity before acting, which may require you to confirm control of your account, and we will respond within the time required by law (for example, 45 days under U.S. state laws or one month under the GDPR, extendable where permitted). If we deny your request, you may appeal by replying with the subject "Privacy Appeal," and we will respond within the time required by law. You may use an authorized agent where the law allows; we may require proof of the agent's authority and verify your identity directly. We will not discriminate against you for exercising your rights.

11. Additional information for U.S. state residents

This section supplements the policy for residents of California and other U.S. states with comprehensive privacy laws, to the extent those laws apply to us.

Categories we collect (in the preceding 12 months), all from you, your device, or our service providers on our behalf: identifiers (name, email address, Account ID, IP address); customer records (account and limited billing information); commercial information (plans and credits purchased, usage history); internet or electronic activity (usage, device, log and session information); audio, visual or similar information (images you upload or generate); inferences (memories derived from your chats); and sensitive personal information (account login credentials, and any sensitive information you choose to include in Your Content). We collect and use this information for the purposes in Section 3, keep it as described in Section 8, and disclose it to the service providers described in Section 6 for business purposes.

Sale and sharing. We do not sell or share personal information, as those terms are defined by the California Consumer Privacy Act and similar laws, and have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only for purposes permitted by law, such as providing the Service you request and securing your account, and not to infer characteristics about you.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

12. International users

Duple is based in the United States, and our service providers process information in the United States and other countries. Those countries may have data protection laws different from those where you live. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. If you are in one of these places, you also have the right to lodge a complaint with your local data protection authority, although we would appreciate the chance to address your concern first.

13. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children under 13, or from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it and close the account. If you believe a child has provided us with personal information, contact us at support@duple.ai.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date, and if a change is material, we will notify you by email or in the Service before it takes effect. Your continued use of the Service after the update takes effect means you acknowledge the updated policy.

15. Contact us

For any question or request about privacy, contact DUPLE.AI LLC at support@duple.ai with the subject "Privacy." Please include your Account ID (shown in Settings → Account).